r22294: Lock the delegated credentials to being kerberos only, we just don't